Preparing your site for Composer 2

What version of Composer you are using

Check if you are already using Composer 2 or need to update:

composer -V

Determine if you can upgrade to composer 2

1. Upgrade to composer 2:

composer selfupdate --2

Note: If updating from version ≤ 1.10.1, you will see an error. In this case, first update to 2.0.1 using an argument instead of the --2 option: composer selfupdate 2.0.1 (composer 2.0.0 had a php8 bug). Then perform step 1 to upgrade to the most recent release.

2. Run updates to see if there are errors:

composer update --dry-run

If this isn't something you want to address immediately, you can downgrade the composer with 

composer selfupdate --1

Most of the errors should be related to various composer plugins. 

You should resolve all of the errors before upgrading to composer 2, as any errors will prevent you from fixing them with composer 2 installed.

Composer Plugins

Plugins are the primary interface between Composer and Drupal, and all need to be updated to be able to work with Composer 2.

The following list of plugins are, so far, ones that people have encountered that prevent them from upgrading to Composer 2.

We should document what the recommended solution is for each, whether it is to remove it entirely because Composer 2 no longer needs it, or which version currently supports it, or, if there is a PR or upstream issue.

Any plugin upgrade must be done using Composer 1. Once all errors have been addressed, go through the same steps above to determine if there are any other issues preventing the composer upgrade.

Upgrade the following plugins to a version of the plugin that supports composer:

Please make sure that you upgrade the plugins below using Composer 1.

• composer/installers
  • Upgrade to ^1.9
• cweagans/composer-patches
  • Upgrade to ^1.7: https://github.com/cweagans/composer-patches/releases/tag/1.7.2
  • If you previously updated to 1.7.0 you may need to update again, as 1.7.1 resolves an issue with Composer 2.1 "where packages would be deleted and not reinstalled during patching".
• acquia/blt
  • Upgrade to ^12 : https://github.com/acquia/blt/pull/4144

• oomphinc/composer-installers-extender

  • Upgrade to ^2.0: https://github.com/oomphinc/composer-installers-extender/issues/29

• simplesamlphp/composer-module-installer
  • Upgrade to ^1.1.7
• joachim-n/composer-manifest
  • Upgrade to ^1.1.1: https://github.com/joachim-n/composer-manifest/pull/6
• dealerdirect/phpcodesniffer-composer-installer
  • Upgrade to ^0.7.0: https://github.com/Dealerdirect/phpcodesniffer-composer-installer/issues/119
    • Note that you may need to use composer require ^0.7.0 (instead of composer update) because composer treats minors as majors when there is no 1.0.0 release.
• drupal-composer/drupal-paranoia
  • Upgrade to ^1.1.0 github.com/drupal-composer/drupal-paranoia/pull/22.
• drupal/console-extend-plugin
  • Upgrade to ^0.9.5. This is a dependency of drupal/console, so you may have to upgrade console to ^1.9.7.
• wikimedia/composer-merge-plugin
  • DEPRECATED, use path repository instead: https://www.drupal.org/node/3069730
  • Upgrade to ^2.0.

Remove the following plugins because they are no longer needed with composer 2:

• hirak/prestissimo
  • See https://github.com/hirak/prestissimo/issues/233#issuecomment-716115604
• zaporylie/composer-drupal-optimizations
  • See https://github.com/zaporylie/composer-drupal-optimizations/issues/16

The following plugins need work to be compatible with composer 2, follow the relevant issues, or help out with them

• grasmash/drupal-security-warning
  • Pull Request https://github.com/grasmash/drupal-security-warning/pull/11
  • Needs a release or upgrade to dev version.
• fenetikm/autoload-drupal
  • https://github.com/fenetikm/autoload-drupal/issues/3
• harvesthq/chosen
  • Pull Request https://github.com/harvesthq/chosen/pull/3066
  • https://www.drupal.org/project/chosen/issues/3102250 (if used with the Drupal Chosen module)

The following plugins are abandoned and should follow instructions to upgrade to their alternative equivalents:

• drupal-composer/drupal-scaffold

  • Site owners should upgrade this plugin to the core version: https://www.drupal.org/docs/develop/using-composer/using-drupals-compose...

Upgrade to composer 2 in Drupal VM :

• Add following settings in file box/config.yml

• # composer settings
composer_keep_updated: true # Always update the composer on provision
composer_version_branch: '--2' # Restrict the update to version 2
   
• Run vagrant provision 

Local packages

1. Remove without updating. --no-update tag will not run any process, but simply update composer.json.

composer remove drupal/console-extend-plugin --no-update

2. Update package to composer 2 compatible versions.

composer require cweagans/composer-patches:^1.7 --no-update

3. Check errors with --dry-run, specify all package names you remove and updated, you can separate it relatively into two steps instead.

composer update cweagans/composer-patches drupal/console-extend-plugin --with-all-dependencies --dry-run

4. Proceed with the update if no errors occurred.

composer update cweagans/composer-patches drupal/console-extend-plugin --with-all-dependencies

Global packages

If you have packages installed globally that aren't compatible with composer 2 and need to be removed, repeat steps 1-4 above with option global.

composer global remove hirak/prestissimo --no-update

composer global update hirak/prestissimo --dry-run

composer global update

Composer as a dependency in your project

If your project has added composer/composer directly to your composer.json (i.e. composer require composer/composer Then you may have issues on versions of core that do not have support for composer 2, i.e. 8.8.* and 9.0.*, and you will not be able to upgrade to composer 2 on those versions until a compatible version of composer/semver is added.  

In most cases you should avoid having composer/composer as a dependency of your project, or, if for some reason your deployment strategy requires that it be embedded, you can composer require it in a subdirectory of your project, and symlink its subordinate vendor dir to vendor/bin/composer. 

It is almost always better to install composer the recommended way (either https://getcomposer.org/download/ or https://getcomposer.org/doc/faqs/how-to-install-composer-programmaticall...) 

Modules with outdated dependencies on composer libraries

Some modules have a dependency on composer/semver:^1, or composer/composer:^1 -> those modules will be uninstallable in core until they update their dependencies (this is very rare)

 Note: It's ok if it's a dependency of another package, e.g. core-dev